v0.1.4

Morphz v0.1.4

Runtime release focused on durable task recovery, bounded event-driven reads,
provider reliability and explicit questions that return to their original work.
This tag publishes Morphz Runtime, morphz-edge and their built-in Dashboard.
It does not publish a separately versioned Desktop installer or a hosted service.

Task reliability and provider recovery

• Preserve ordinary chat as plain text through native Session IO. Work calls
  retain their actual tool schemas, authorization and durable execution receipts.
• Recover from output-token limits without executing incomplete tool arguments
  or presenting a truncated answer as normally completed.
• Keep inherited model and reasoning settings live at request boundaries while
  preserving explicit task selections and requests already sent to a provider.
• Preserve the original request's provider identity through recovery; distinguish
  missing credentials, exhausted account quota and transport failures.
• Use max_tokens for official DeepSeek Chat output limits. Compatible gateways
  can explicitly select their parameter dialect; model names do not guess it.
• Correct dialogue admission during context maintenance, owned child-work waits,
  no-reply control validation and durable cancellation/terminal-state attribution.
• Reconcile abandoned background-monitoring owners without creating another
  concurrently active owner for the same work.

Persistent questions and execution inspection

• Add Runtime-owned request_user_input questions with optional single- or
  multiple-choice answers and free text. Pending questions and accepted answers
  remain attached to their exact thread and execution generation across restart.
• Direct answers and supplements to their original work. A stale question,
  changed generation, duplicate answer or unauthorized destination cannot become
  a reply to another task.
• Expose real child work, delegation provenance, effective model settings and
  public progress through bounded read projections. Optional presentation
  annotations do not grant authority or manufacture execution state.
• Keep actual connection diagnostics and scoped data-read failures distinct;
  one failed read does not discard independently healthy work state.

Bounded reads and storage

• Drive current-work reconciliation from committed changes, with bounded cursor
  recovery and coalesced invalidation instead of healthy-period history polling.
• Load the newest authorized conversation page first; read older messages on
  explicit upward navigation or an exact source jump, using indexed keyset seeks.
• Preserve a newly submitted message through local acknowledgement and Runtime
  history handoff, including uncertain acceptance and failed delivery.
• Correct SQLite transaction contention, PostgreSQL execution boundaries and
  durable recovery; keep the real failure and retry identity available.

Terminals and native sandboxing

• Add Runtime-owned terminal sessions with real PTY input, authorization,
  persistent execution provenance and platform-native sandbox enforcement.
• On Linux, command protection requires the administrator-installed Morphz
  policy service and trusted native Runtime image in addition to Bubblewrap.
  Protection includes files created after admission and descendant processes;
  Bubblewrap alone is not a supported fallback.
• Read the archive's linux-sandbox/INSTALL.md for installation, upgrade,
  rollback and removal. The service uses an approved immutable root-owned image;
  the Agent and its work continue to run as a non-root user. The ordinary
  user-level installer does not install or authorize privileged components.
• Refresh vulnerable dependencies and retain the platform components, checksums
  and third-party license records required by the distributed archives.

Dashboard and related application fixes

• Make pending questions reachable from the existing supplement action and
  answer them in the composer. Single-choice selection submits the answer;
  multiple-choice answers retain explicit submission.
• Preserve mature Markdown/link parsing while fixing autolinks that consumed
  adjacent emphasis or Chinese text; retain local-file and exact content links.
• Correct message chronology, quoted-source navigation, shared model defaults,
  connection diagnostics and the presentation of active child work.
• Related Desktop fixes are retained in the source tree. This Runtime release
  does not claim that every Dashboard control has been migrated to Desktop.

Upgrading and integration compatibility

The cumulative changes since v0.1.3 include new capabilities and changes to
development-time SDK, Harness and model-facing contracts. The 0.1.4 version
number does not promise source/API compatibility with 0.1.3. Recompile
integrations against this source and review current schemas. Retained stored
identities and execution receipts do not authorize replaying retired tools or
rewriting historical work.

Before replacing a running Runtime, stop it normally and take a verified backup
of its configured data. Retain the previous executable and that backup. Database
migrations are not reversed by installing an older executable; a storage
downgrade requires its matching pre-upgrade backup. Do not replay work that may
already have produced external effects merely because its earlier response was
lost or failed.

Install the exact release with the verified release installer, or select it
explicitly through the updater:

MORPHZ_VERSION=v0.1.4 sh install.sh
morphz update --to 0.1.4

Confirm morphz --version reports 0.1.4 after installation. The published
stable release is eligible for the default stable installer/update channel.
Signed Edge manifests are a separate distribution channel; publishing these
archives does not itself update a hosted manifest.

Distribution and validation boundaries

Runtime and Edge archives cover macOS Apple Silicon and Intel, Linux ARM64 and
x86_64, and Windows x86_64. Release automation requires complete successful CI
and Application runs for the exact source commit, then packaged Runtime,
Session IO, installed Linux sandbox and platform checks before publication.
The archives ship SHA-256 records and an exact-commit CI admission receipt.

Official DeepSeek Chat output-limit acceptance used synthetic input and a
32-token budget: the provider returned exactly 32 output tokens with length,
correctly classified as an output limit. It sent no user Context and invoked
no tools. This is a specific provider check, not arbitrary-model acceptance;
Qwen, Kimi, GLM and quantized-model acceptance remain separate work.